Enterprise authority management method, system and equipment based on machine learning and medium

Abstract

The invention discloses an enterprise authority management method and system based on machine learning, equipment and a medium, and the method comprises the steps: obtaining historical operation behavior data of a target user, preprocessing the historical operation behavior data, and inputting the preprocessed historical operation behavior data into a preset enterprise authority risk assessment model based on machine learning for training; acquiring real-time operation behavior data of the target user, and inputting the real-time operation behavior data into the trained enterprise permission risk assessment model to obtain a permission risk assessment result of the target user; and adjusting the target user to perform the permission allocation strategy according to the permission risk assessment result. Compared with the prior art, the enterprise authority risk assessment method has the advantages that the enterprise authority risk assessment risk model is established by combining machine learning and artificial intelligence technologies, then intelligent analysis and dynamic authority allocation are performed on enterprise user behaviors, potential authority abuse and safety risks are detected in real time, and the enterprise authority risk assessment risk is improved. Therefore, the overall information security protection capability of the enterprise is improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an enterprise authority management method, system, device and medium based on machine learning. Background Art

[0002] With the acceleration of digital transformation of enterprises, a large number of rights management and sensitive operations are involved in enterprise systems. At present, the existing rights management methods are generally based on the roles of enterprise employees, that is, the rights of employees are fixedly allocated according to their job types or levels. However, the above rights management methods lack flexibility and cannot dynamically manage the rights of employees. Summary of the invention

[0003] The purpose of the present invention is to provide an enterprise authority management method, system, device and medium based on machine learning to solve the problem in related technologies that the authority of enterprise employees cannot be dynamically adjusted.

[0004] In order to achieve the above object, the present invention provides the following technical solutions:

[0005] First aspect: The present invention provides an enterprise authority management method based on machine learning, including: obtaining first historical operation behavior data of a target user, and performing a preprocessing operation on the historical operation behavior data to obtain second historical operation behavior data; inputting the second historical operation behavior data into a preset enterprise authority risk assessment model based on machine learning for training to obtain a trained enterprise authority risk assessment model; obtaining real-time operation behavior data of the target user, and inputting the real-time operation behavior data into the trained enterprise authority risk assessment model to obtain an authority risk assessment result of the target user; and adjusting the authority allocation strategy of the target user according to the authority risk assessment result.

[0006] Preferably, the method further includes: obtaining historical permission usage data of the target user, inputting the historical permission usage data into a preset abnormal behavior detection model to perform abnormal behavior detection, and obtaining an abnormal behavior detection result of the target user; if abnormal behavior exists in the abnormal behavior detection result, adjusting the permission of the target user according to the level of the abnormal behavior; generating a permission abnormality report according to the abnormal behavior, and sending the permission abnormality report to the permission management personnel.

[0007] Preferably, the method also includes: obtaining real-time permission usage data of the target user, and inputting the real-time permission usage data into a preset permission risk detection model for analysis and prediction, to obtain a permission risk prediction result of the target user; if there is a risk in the permission risk prediction result, sending an alarm message to the permission management personnel for processing.

[0008] Preferably, the method further comprises: automatically generating permission configuration according to the historical permission usage data of the target user and the historical permission usage data of similar users, and sending the permission configuration to the permission management personnel for review and approval.

[0009] Preferably, the preprocessing operation includes: merging, cleaning, filtering the data, and structuring and standardizing the filtered data.

[0010] Preferably, the enterprise rights management model based on machine learning adopts K-means clustering algorithm, and the specific calculation formula is as follows:

[0011]

[0012] Among them, C i is the distance from the sample point to the cluster center, x i is the user behavior feature vector, u j The center of the jth cluster, w ij For x i Indicator function belonging to the jth cluster.

[0013] Preferably, the target user is assigned permissions according to the permission risk assessment result, using the following calculation formula:

[0014]

[0015] Where P represents the permission allocation strategy, R(P) is the risk function under the permission allocation strategy P, C(P) is the cost of permission allocation, λ is the trade-off coefficient, and argmin represents finding the parameters that minimize the objective function.

[0016] In a second aspect, the present invention also provides an enterprise authority management system based on machine learning, comprising: an acquisition module, used to acquire first historical operation behavior data of a target user, and obtain second historical operation behavior data after preprocessing the historical operation behavior data; a training module, used to input the second historical operation behavior data into a preset enterprise authority risk assessment model based on machine learning for training, and obtain a trained enterprise authority risk assessment model; a risk assessment module, used to acquire real-time operation behavior data of the target user, and input the real-time operation behavior data into the trained enterprise authority risk assessment model, and obtain an authority risk assessment result of the target user; and an authority management module, used to adjust the authority allocation strategy of the target user according to the authority risk assessment result.

[0017] Preferably, the system also includes: an anomaly detection module, used to obtain historical permission usage data of the target user, input the historical permission usage data into a preset abnormal behavior detection model to perform abnormal behavior detection, and obtain an abnormal behavior detection result of the target user; if abnormal behavior exists in the abnormal behavior detection result, adjust the permission of the target user according to the level of the abnormal behavior; generate a permission anomaly report based on the abnormal behavior, and send the permission anomaly report to the permission management personnel.

[0018] Preferably, the system also includes: a permission risk prediction module, which is used to obtain the real-time permission usage data of the target user, and input the real-time permission usage data into a preset permission risk detection model for analysis and prediction, to obtain the permission risk prediction result of the target user; if there is a risk in the permission risk prediction result, an alarm information is sent to the permission management personnel for processing.

[0019] Preferably, the system further comprises: a permission configuration module, which is used to automatically generate permission configuration according to the historical permission usage data of the target user and the historical permission usage data of similar users, and send it to the permission management personnel for review and approval.

[0020] In a third aspect, the present invention also provides a computer electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of any one of the above-mentioned machine learning-based enterprise authority management methods are implemented.

[0021] In a fourth aspect, the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of any one of the above-mentioned machine learning-based enterprise authority management methods are implemented.

[0022] The present invention provides a method, system, device and medium for enterprise authority management based on machine learning. The method obtains the first historical operation behavior data of the target user, and obtains the second historical operation behavior data after preprocessing the historical operation behavior data; inputs the second historical operation behavior data into a preset enterprise authority risk assessment model based on machine learning for training to obtain a trained enterprise authority risk assessment model; obtains the real-time operation behavior data of the target user, and inputs the real-time operation behavior data into the trained enterprise authority risk assessment model to obtain the authority risk assessment result of the target user; and adjusts the authority allocation strategy of the target user according to the authority risk assessment result. Compared with the related art, the present invention has the following effects: the present invention combines machine learning and artificial intelligence technology to establish an enterprise authority risk assessment risk model, and then intelligently analyzes the behavior of enterprise users and dynamically allocates authority, and detects potential authority abuse and security risks in real time, thereby improving the overall information security protection capabilities of the enterprise. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 It is a flowchart of a method for enterprise rights management based on machine learning according to an embodiment of the present invention;

[0024] Figure 2 This is a schematic diagram of the structure of an enterprise rights management system based on machine learning according to an embodiment of the present invention;

[0025] Figure 3 It is a structural schematic diagram of a computer electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0026] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0027] It should be noted that when an element is referred to as being "fixed to" another element, it may be directly on the other element or there may be a central element. When an element is considered to be "connected to" another element, it may be directly connected to the other element or there may be a central element at the same time. In contrast, when an element is referred to as being "directly on" another element, there is no intermediate element. The terms "vertical", "horizontal", "left", "right" and similar expressions used herein are for illustrative purposes only.

[0028] In the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0029] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0030] The terms used in one or more embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of the present invention. The singular forms "a", "said" and "the" used in one or more embodiments of the present invention are also intended to include plural forms, unless the context clearly indicates other meanings.

[0031] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein in the specification of the template are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The term "and / or" used herein includes any and all combinations of one or more of the associated listed items.

[0032] It should be understood that, although the terms first, second, etc. may be used to describe various information in one or more embodiments of the present invention, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of the present invention, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "when..." or "when...".

[0033] At present, the existing enterprise rights management methods have the following problems, as follows

[0034] 1. Role-based access control (RBAC): This is a traditional permission allocation model in which users are assigned permissions based on predefined roles. Although RBAC helps simplify management, it lacks flexibility and cannot dynamically adjust permissions.

[0035] 2. Manual review and approval process: Enterprises will allocate permissions through a strict permission approval process to ensure the accuracy and compliance of permission allocation, but the efficiency is low and it relies on manual operations.

[0036] 3. Rule-based risk detection systems: Many systems perform risk detection based on predefined rules, but these systems have difficulty adapting to new threats or handling complex abnormal behaviors.

[0037] These methods have obvious limitations when dealing with dynamic security threats and complex permission structures, and cannot achieve intelligent real-time risk warnings.

[0038] The technical solution of the present invention and how the technical solution of the present invention solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes are not repeated in some embodiments. The embodiments of the present invention will be described below in conjunction with the accompanying drawings.

[0039] See also Figure 1 The embodiment of the present invention provides an enterprise rights management method based on machine learning, which is applied to a rights management system and includes the following steps:

[0040] S10: Acquire first historical operation behavior data of a target user, and perform a preprocessing operation on the historical operation behavior data to obtain second historical operation behavior data.

[0041] Specifically, in this embodiment, the user's operation behavior data is first obtained, and the operation behavior data may include: login frequency, operation path, resource access, etc.; after the user's operation behavior data is obtained, in order to facilitate the subsequent use of the data, it is necessary to perform preprocessing operations on the data, and the preprocessing operations may include: processing the numerical value of the data and processing the format of the data. For example, the numerical processing of the data may include: processing missing values ​​and processing abnormal values, etc.; the format processing of the data may include: standardizing and normalizing the data.

[0042] In a specific embodiment, the preprocessing operation includes: merging, cleaning, filtering the data, and structuring and standardizing the filtered data.

[0043] S20. Input the second historical operation behavior data into a preset enterprise authority risk assessment model based on machine learning for training to obtain a trained enterprise authority risk assessment model.

[0044] It can be understood that in this embodiment, after obtaining the second historical operation behavior data, the data needs to be input into the preset enterprise authority risk assessment model based on machine learning for training. During the training, the parameters of the model are continuously adjusted to make the prediction results on the training set as close to the true value as possible, thereby improving the accuracy of the model's prediction of authority risks.

[0045] It should be noted that the preset enterprise authority risk assessment model based on machine learning can be constructed by various artificial intelligence algorithms, such as: neural network, Bayesian classifier, etc.

[0046] In a specific embodiment, the enterprise rights management model based on machine learning is as follows: the user's operation behavior is divided into K clusters using the K-means clustering algorithm, and the specific calculation formula is as follows:

[0047] Distance from sample point to cluster center:

[0048] Update cluster centers:

[0049] The objective function is defined as:

[0050] Among them, C i is the distance from the sample point to the cluster center, x i is the user behavior feature vector, u j The center of the jth cluster, w ij For x i Indicator function belonging to the jth cluster.

[0051] S30: Acquire the real-time operation behavior data of the target user, and input the real-time operation behavior data into the trained enterprise authority risk assessment model to obtain the authority risk assessment result of the target user.

[0052] Specifically, in this example, by inputting the target user's real-time operation behavior data into the trained enterprise permission risk assessment model, the permission risk assessment result of the target user can be analyzed and obtained, and the result of the permission risk assessment is used as a basis for subsequent permission adjustments.

[0053] S40: adjusting the target user's authority allocation strategy according to the authority risk assessment result.

[0054] It can be understood that the result of the permission risk assessment can be a probability value or a numerical value. For example, when the result of the permission risk assessment is a numerical value, the permission risk can be divided by setting different thresholds. For example, it can be seen that by setting two thresholds, a first threshold and a second threshold, the first threshold is less than the second threshold. When the result of the permission risk assessment is less than the first threshold, it means that the user's permission risk is low risk, and there is no need to adjust the user's permissions; when the result of the permission risk assessment is greater than the first threshold and less than the second threshold, it means that the user's permission risk is medium risk, and it is necessary to adjust the user's key permission functions, for example, shut down the permission to view key files; when the result of the permission risk assessment is greater than the second threshold, it means that the user's permission risk is high risk, and it is necessary to quickly adjust the user's permissions, for example, use the system default least privilege principle or directly shut down the user's permissions.

[0055] In a specific embodiment, the rights allocation to the target user according to the rights risk assessment result is performed using the following calculation formula:

[0056]

[0057] Where P represents the permission allocation strategy, R(P) is the risk function under the permission allocation strategy P, C(P) is the cost of permission allocation, λ is the trade-off coefficient, and argmin represents finding the parameters that minimize the objective function.

[0058] The embodiment of the present invention provides an enterprise authority management method based on machine learning, which obtains the first historical operation behavior data of the target user, and obtains the second historical operation behavior data after preprocessing the historical operation behavior data; inputs the second historical operation behavior data into a preset enterprise authority risk assessment model based on machine learning for training, and obtains the trained enterprise authority risk assessment model; obtains the real-time operation behavior data of the target user, and inputs the real-time operation behavior data into the trained enterprise authority risk assessment model to obtain the authority risk assessment result of the target user; and adjusts the authority allocation strategy of the target user according to the authority risk assessment result. Compared with the related art, it has the following effects: the present invention combines machine learning and artificial intelligence technology to establish an enterprise authority risk assessment risk model, and then intelligently analyzes the behavior of enterprise users and dynamically allocates authority, and detects potential authority abuse and security risks in real time, thereby improving the overall information security protection capabilities of the enterprise.

[0059] In some optional embodiments, the method further includes: S50, obtaining historical permission usage data of the target user, inputting the historical permission usage data into a preset abnormal behavior detection model to perform abnormal behavior detection, and obtaining an abnormal behavior detection result of the target user; if abnormal behavior exists in the abnormal behavior detection result, adjusting the permission of the target user according to the level of the abnormal behavior; generating a permission abnormality report according to the abnormal behavior, and sending the permission abnormality report to the permission management personnel.

[0060] Specifically, in this embodiment, by obtaining the target user's permission usage behavior data and performing big data analysis, it is determined whether the user uses the permissions abnormally. For example, if a user submits an abnormal number of permission applications or accesses a large number of sensitive files in a short period of time, these behaviors will be identified as abnormal by the model. When permission usage occurs, the system will initiate an adjustment mechanism, for example, adopting the principle of least privilege to ensure that users only have the minimum permissions required to complete the task.

[0061] It is understandable that in this instance, the permission management system will collect information about abnormal permission behavior, automatically generate permission exception reports, and send permission exception reports to permission managers on a regular basis so that the permission managers can obtain permission exception situations in a timely manner and determine whether to take corresponding measures.

[0062] In a specific embodiment, the abnormal behavior detection model uses a machine learning Isolation Forest algorithm to detect abnormal behavior, assuming that the user's normal behavior pattern conforms to the concentrated area of ​​the multi-dimensional feature space, and the abnormal behavior is located in the sparse area.

[0063] Isolation Forest identifies anomalies based on the segmentation of decision trees:

[0064] Anomaly score calculation formula, for each user behavior data point x, its anomaly score is defined as:

[0065]

[0066] in,

[0067]

[0068] Among them, and the (n)th harmonic number H(n) is defined as:

[0069]

[0070] Where E(h(x)) is the average path length of the data point x, c(n) is the regularization constant of the tree path length, and n is the total number of data points.

[0071] In some optional embodiments, the method also includes: S60, obtaining the real-time permission usage data of the target user, and inputting the real-time permission usage data into a preset permission risk detection model for analysis and prediction, to obtain the permission risk prediction result of the target user; if there is a risk in the permission risk prediction result, sending an alarm message to the permission management personnel for processing.

[0072] Specifically, in this example, the permission management system will automatically collect the real-time permission usage data of the target user, and input the real-time permission usage data into the permission risk detection model for analysis and prediction, to obtain the permission risk prediction result of the target user; when it is found that the permission risk prediction result is at risk, an alarm message will be sent to the permission management personnel for processing. At the same time, in order to avoid the impact caused by high-risk operations, the user's permissions can be reduced or shut down. After confirmation by the permission management personnel, the permissions can be opened.

[0073] In a specific embodiment, the preset permission risk detection model uses a random forest algorithm to predict the potential risk of permission abuse. The random forest is classified or regressed through multiple decision trees, and its classification decision function is: random forest classification formula, which is as follows:

[0074] Given m trees, the final prediction of the random forest is the mode of the predictions of each tree:

[0075] y^=mode{T1(x),T2(x),…,Tm(x)}

[0076] Here, Ti(x) is the prediction of the i-th tree for the input x.

[0077] In some optional embodiments, the method further includes: S70, automatically generating permission configuration according to the historical permission usage data of the target user and the historical permission usage data of similar users, and sending it to the permission management personnel for review and approval.

[0078] It can be understood that in order to meet the needs of enterprise employees to better use permissions, in this embodiment, the permission management system will comprehensively generate the permission configuration of the user based on the user's historical permission usage and the permission usage of users similar to the user, and configure the permission, so that the administrator does not need to manually review each permission application. The system will automatically evaluate the rationality of the application according to the preset rules and provide actionable suggestions, such as approval, rejection or further review. This mechanism reduces the workload of administrators by improving approval efficiency, while reducing human errors in permission allocation, ensuring the rationality and security of permissions.

[0079] In a specific embodiment, a Bayesian classifier is used to automatically recommend a reasonable permission configuration, and the specific calculation formula is as follows:

[0080] For permission requests P(y|X), where y is the category of permission requests approved or rejected and X is the feature vector of the request, Bayes’ theorem is applied:

[0081]

[0082] Among them, P(X|y) represents the conditional probability of feature X under category y; P(y) is the prior probability of category y; and P(X) is the total probability of feature X.

[0083] See also Figure 2 The embodiment of the present invention also provides an enterprise rights management system 200 based on machine learning, including:

[0084] The acquisition module 201 is used to acquire first historical operation behavior data of a target user, and obtain second historical operation behavior data after performing a preprocessing operation on the historical operation behavior data;

[0085] A training module 202 is used to input the second historical operation behavior data into a preset enterprise authority risk assessment model based on machine learning for training, so as to obtain a trained enterprise authority risk assessment model;

[0086] The risk assessment module 203 is used to obtain the real-time operation behavior data of the target user, and input the real-time operation behavior data into the trained enterprise authority risk assessment model to obtain the authority risk assessment result of the target user;

[0087] The permission management module 204 is used to adjust the permission allocation strategy of the target user according to the permission risk assessment result.

[0088] In some optional embodiments, the system 200 also includes: an anomaly detection module 205, which is used to obtain historical permission usage data of the target user, input the historical permission usage data into a preset abnormal behavior detection model to perform abnormal behavior detection, and obtain an abnormal behavior detection result of the target user; if there is abnormal behavior in the abnormal behavior detection result, adjust the permission of the target user according to the level of the abnormal behavior; generate a permission anomaly report based on the abnormal behavior, and send the permission anomaly report to the permission management personnel.

[0089] In some optional embodiments, the system 200 also includes: a permission risk prediction module 206, which is used to obtain the real-time permission usage data of the target user, and input the real-time permission usage data into a preset permission risk detection model for analysis and prediction, to obtain the permission risk prediction result of the target user; if there is a risk in the permission risk prediction result, an alarm message is sent to the permission management personnel for processing.

[0090] In some optional embodiments, the system 200 further includes: a permission configuration module 207, which is used to automatically generate permission configuration based on the historical permission usage data of the target user and the historical permission usage data of similar users, and send it to the permission management personnel for review and approval.

[0091] See also Figure 3 An embodiment of the present invention further provides a computer electronic device 400, including a memory 403 and a processor 402, wherein the memory 403 stores a computer program, and when the processor executes the computer program, the steps of the enterprise authority management method of machine learning described in any one of the above items are implemented.

[0092] Specifically, the electronic device 400 includes: a transceiver 401, a bus interface and a processor 402, the processor 402 is used to obtain the first historical operation behavior data of the target user, and obtain the second historical operation behavior data after preprocessing the historical operation behavior data; input the second historical operation behavior data into a preset enterprise authority risk assessment model based on machine learning for training to obtain the trained enterprise authority risk assessment model; obtain the real-time operation behavior data of the target user, and input the real-time operation behavior data into the trained enterprise authority risk assessment model to obtain the authority risk assessment result of the target user; adjust the authority allocation strategy of the target user according to the authority risk assessment result.

[0093] In the embodiment of the present invention, the electronic device 400 further includes a memory 403. Figure 3 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking various circuits of one or more processors represented by processor 402 and memory represented by memory 403. The bus architecture may also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 401 may be a plurality of components, i.e., including a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium. The processor 402 is responsible for managing the bus architecture and general processing, and the memory 403 may store data used by the processor 402 when performing operations.

[0094] An embodiment of the present invention also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps of the enterprise authority management method for machine learning described in any one of the above are implemented.

[0095] In this embodiment, the computer readable storage medium may be a non-volatile storage medium or a volatile storage medium. For example, the computer storage medium may include but is not limited to: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0096] In all examples shown and described herein, any specific values ​​should be interpreted as merely exemplary and not as limiting, and thus other examples of the exemplary embodiments may have different values.

[0097] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0098] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and structure diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in an alternative implementation, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the structure diagram and / or the flow diagram, and the combination of boxes in the structure diagram and / or the flow diagram, can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0099] In addition, the functional modules or units in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0100] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a terminal device (which can be a smart phone, a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application.

[0101] The above description is only a specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. A method for enterprise rights management based on machine learning, characterized in that: include: Acquire first historical operation behavior data of the target user, and perform a preprocessing operation on the historical operation behavior data to obtain second historical operation behavior data; Inputting the second historical operation behavior data into a preset enterprise authority risk assessment model based on machine learning for training, thereby obtaining a trained enterprise authority risk assessment model; Acquire the real-time operation behavior data of the target user, and input the real-time operation behavior data into the trained enterprise authority risk assessment model to obtain the authority risk assessment result of the target user; The target user's permission allocation strategy is adjusted according to the permission risk assessment result.

2. The enterprise rights management method according to claim 1, characterized in that: The method further comprises: Acquire historical permission usage data of the target user, input the historical permission usage data into a preset abnormal behavior detection model to perform abnormal behavior detection, and obtain an abnormal behavior detection result of the target user; If there is abnormal behavior in the abnormal behavior detection result, adjusting the authority of the target user according to the level of the abnormal behavior; Generate a permission exception report based on the abnormal behavior, and send the permission exception report to the permission management personnel.

3. The enterprise rights management method according to claim 1, characterized in that: The method further comprises: Acquire the real-time permission usage data of the target user, and input the real-time permission usage data into a preset permission risk detection model for analysis and prediction, to obtain a permission risk prediction result of the target user; If there is a risk in the authority risk prediction result, an alarm message is sent to the authority management personnel for processing.

4. The enterprise rights management method according to claim 2, characterized in that: The method comprises: According to the historical permission usage data of the target user and the historical permission usage data of similar users, permission configuration is automatically generated and sent to the permission management personnel for review and approval.

5. The enterprise rights management method according to claim 1, characterized in that: The preprocessing operation includes: merging, cleaning, filtering the data, and structuring and standardizing the filtered data.

6. The enterprise rights management method according to claim 1, characterized in that: The enterprise rights management model based on machine learning adopts the K-means clustering algorithm, and the specific calculation formula is as follows: Among them, C i is the distance from the sample point to the cluster center, x i is the user behavior feature vector, u j The center of the jth cluster, w ij For x i Indicator function belonging to the jth cluster.

7. The enterprise rights management method according to claim 1, characterized in that: The target user is assigned permissions according to the permission risk assessment result, using the following calculation formula: Where P represents the permission allocation strategy, R(P) is the risk function under the permission allocation strategy P, C(P) is the cost of permission allocation, λ is the trade-off coefficient, and argmin represents finding the parameters that minimize the objective function.

8. An enterprise rights management system based on machine learning, characterized in that: include: An acquisition module, used to acquire first historical operation behavior data of a target user, and obtain second historical operation behavior data after performing a preprocessing operation on the historical operation behavior data; A training module, used for inputting the second historical operation behavior data into a preset enterprise authority risk assessment model based on machine learning for training, so as to obtain a trained enterprise authority risk assessment model; A risk assessment module is used to obtain the real-time operation behavior data of the target user, and input the real-time operation behavior data into the trained enterprise authority risk assessment model to obtain the authority risk assessment result of the target user; The permission management module is used to adjust the permission allocation strategy of the target user according to the permission risk assessment result.

9. A computer electronic device, characterized in that: It includes a memory and a processor, the memory stores a computer program, and the processor implements the steps of the enterprise rights management method based on machine learning described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the enterprise rights management method based on machine learning described in any one of claims 1 to 7 are implemented.

Images